{"record":{"id":"eb030f091419cc50","repo":"flowable/flowable-engine","slug":"involved-user-is-null-eb030f","errorCode":null,"errorMessage":"Involved user is null","messagePattern":"Involved user is null","errorType":"exception","errorClass":"ActivitiIllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/flowable5-engine/src/main/java/org/activiti/engine/impl/ProcessInstanceQueryImpl.java","lineNumber":346,"sourceCode":"            this.subProcessInstanceId = subProcessInstanceId;\n        }\n        return this;\n    }\n\n    @Override\n    public ProcessInstanceQuery excludeSubprocesses(boolean excludeSubprocesses) {\n        if (inOrStatement) {\n            this.currentOrQueryObject.excludeSubprocesses = excludeSubprocesses;\n        } else {\n            this.excludeSubprocesses = excludeSubprocesses;\n        }\n        return this;\n    }\n\n    @Override\n    public ProcessInstanceQuery involvedUser(String involvedUser) {\n        if (involvedUser == null) {\n            throw new ActivitiIllegalArgumentException(\"Involved user is null\");\n        }\n\n        if (inOrStatement) {\n            this.currentOrQueryObject.involvedUser = involvedUser;\n        } else {\n            this.involvedUser = involvedUser;\n        }\n        return this;\n    }\n\n    @Override\n    public ProcessInstanceQuery active() {\n        if (inOrStatement) {\n            this.currentOrQueryObject.suspensionState = SuspensionState.ACTIVE;\n        } else {\n            this.suspensionState = SuspensionState.ACTIVE;\n        }\n        return this;","sourceCodeStart":328,"sourceCodeEnd":364,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable5-engine/src/main/java/org/activiti/engine/impl/ProcessInstanceQueryImpl.java#L328-L364","documentation":"ProcessInstanceQuery.involvedUser() rejects a null user id. Involvement is tracked via identity links, and a null user cannot match any identity-link row, so the library fails fast with ActivitiIllegalArgumentException rather than building a query with a meaningless null filter.","triggerScenarios":"Calling processInstanceQuery().involvedUser(null), typically when the userId variable passed from an upstream layer (session, request parameter, task assignee lookup) is null.","commonSituations":"Unauthenticated or anonymous users reaching a 'my involved processes' page; a user id lookup that returned null before building the query; optional request parameters mapped straight into the query call.","solutions":["Check the user id for null before calling involvedUser and skip the filter when absent.","Resolve the current authenticated user first and reject requests without one.","Catch ActivitiIllegalArgumentException around query building to return a 400-style validation response.","Log the call site where the null id originates to fix the upstream data flow."],"exampleFix":"// before\nquery.involvedUser(userId); // userId may be null\n\n// after\nif (userId != null) {\n    query.involvedUser(userId);\n}","handlingStrategy":"validation","validationCode":"if (userId == null || userId.isBlank()) {\n    throw new IllegalArgumentException(\"involvedUser id must not be null\");\n}\nquery.involvedUser(userId);","typeGuard":"boolean hasUserId(String userId) {\n    return userId != null && !userId.isBlank();\n}","tryCatchPattern":"try {\n    query.involvedUser(userId);\n} catch (org.activiti.engine.ActivitiIllegalArgumentException e) {\n    // handle null user, e.g. return empty result or 400\n}","preventionTips":["Resolve the authenticated user before building user-scoped queries.","Use Objects.requireNonNull on ids at API boundaries.","Skip the involvedUser filter rather than passing null when user context is absent."],"tags":["query","null-check","validation","activiti"],"backgroundTag":"null-argument","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}